Issues

• Email alerts: the CentOS install command of the SMTP relay fails on RHEL 9, which has no mailx package

  level/taskmodule/analysisreporter/qatype/bug
  wazuh/wazuh-documentation#10444 · Filter by author DiegoRatto opened on Oct 21, 2026

• Azure dependencies: the Python 3.12 to 3.13 pins do not load the 4.14 wodle, and the Yum branch cannot build cffi

  azurelevel/taskreporter/qatype/bug
  wazuh/wazuh-documentation#10443 · Filter by author DiegoRatto opened on Oct 21, 2026

• IT hygiene: the ports table swaps local and remote, Traffic is not the listening ports, browser.name and the API list miss values, and four alert field examples lack their type

  level/taskmodule/syscollectorreporter/qatype/bug
  wazuh/wazuh-documentation#10441 · Filter by author DiegoRatto opened on Oct 21, 2026

• Puppet deployment: the password change leaves out vulnerability_indexer_password, shows dashboard_wazuh_api_credentials as a string, and the setup pages mix Puppet 7 and 8

  level/taskpuppetreporter/qatype/bug
  wazuh/wazuh-documentation#10439 · Filter by author DiegoRatto opened on Oct 21, 2026

• SCA how it works: a Not applicable check has a result field in alerts and in the Server API, and no status field

  level/taskmodule/scareporter/qatype/bug
  wazuh/wazuh-documentation#10438 · Filter by author DiegoRatto opened on Oct 21, 2026

• macOS agent: the FIM defaults still name /etc, the Unified Logging block lacks sshd-session and sshd-auth, and successful sudo needs log_allowed on macOS 15 and later

  level/taskmacOSmodule/fimmodule/logcollectorreporter/qatype/bug
  wazuh/wazuh-documentation#10437 · Filter by author DiegoRatto opened on Oct 21, 2026

• Microsoft Graph: the sample alerts show the wrong rule and decoder, only_future_events also collects records older than the module start, and a malformed block logs errors, not a warning

  level/taskmodule/msgraphreporter/qatype/bug
  wazuh/wazuh-documentation#10436 · Filter by author DiegoRatto opened on Oct 21, 2026

• Email alerts: the documented defaults of email_alert_level and email_log_source are the shipped ossec.conf values, and the rule 502 example sends no email

  level/taskmodule/analysisreporter/qatype/bug
  wazuh/wazuh-documentation#10435 · Filter by author DiegoRatto opened on Oct 21, 2026

• FIM proof of concept: changes made right after the Windows agent restart get no alert, because real-time monitoring starts only after the initial scan

  level/taskmodule/fimreporter/qatype/bug
  wazuh/wazuh-documentation#10434 · Filter by author DiegoRatto opened on Oct 21, 2026

• Blocking a known malicious actor PoC: the sudo echo command that appends the attacker IP fails with Permission denied

  level/taskreporter/qatype/bug
  wazuh/wazuh-documentation#10432 · Filter by author DiegoRatto opened on Oct 21, 2026

• SCA configuration: the pushed policy path etc/shared does not exist on Windows agents, and the restart step has no Windows or macOS command

  level/taskmodule/scareporter/qatype/bug
  wazuh/wazuh-documentation#10431 · Filter by author DiegoRatto opened on Oct 21, 2026

• Syscollector configuration: the default block shows ports all="no" again and gives the macOS file as /Library/Ossec/ossec.conf

  level/taskmodule/syscollectorreporter/qatype/bug
  wazuh/wazuh-documentation#10429 · Filter by author DiegoRatto opened on Oct 21, 2026

• External API integrations: the Shuffle webhook URL example points to shuffle.io, a domain for sale, instead of shuffler.io

  level/taskmodule/integratorreporter/qatype/bug
  wazuh/wazuh-documentation#10428 · Filter by author DiegoRatto opened on Oct 21, 2026

• MITRE ATT&CK page: the module and its Events tab are under menus the Wazuh dashboard no longer has

  level/taskreporter/qarulesettype/bug
  wazuh/wazuh-documentation#10427 · Filter by author DiegoRatto opened on Oct 21, 2026

• VirusTotal integration: How it works calls the query an HTTP POST and says integrations.log always records it

  level/taskmodule/integratorreporter/qatype/bug
  wazuh/wazuh-documentation#10426 · Filter by author DiegoRatto opened on Oct 21, 2026

• Name CentOS Stream 9 and 10 in the package list and the Vulnerability Detection compatibility matrix

  level/tasktype/enhancement
  wazuh/wazuh-documentation#10422 · Filter by author Antoniogm03 opened on Oct 21, 2026

• Document logcollector remote_commands gating of centralized sockets

  level/taskmodule/logcollector
  wazuh/wazuh-documentation#10411 · Filter by author cborla opened on Oct 19, 2026

• Dashboard configuration docs say the health check creates five default notification channels, including Email, and tell the user to run the checks, but the indexer creates four and the page has no way to run checks

  level/tasktype/bug
  wazuh/wazuh-documentation#10398 · Filter by author Rebits opened on Oct 16, 2026

• GCP dependencies: the Python 3.11-3.13 pip command fails on Ubuntu 24.04 because it cannot uninstall the system typing_extensions

  gcplevel/taskreporter/qatype/bug
  wazuh/wazuh-documentation#10387 · Filter by author DiegoRatto opened on Oct 15, 2026

• No YARA alert for the documented Mirai and Xbash samples on 4.14.9 RC2

  level/tasktype/bug
  wazuh/wazuh-documentation#10384 · Filter by author rafabailon opened on Oct 9, 2026
  1

• Microsoft Graph API setup: the API permissions leave out DeviceManagementApps.Read.All, which the sample configuration needs for auditEvents

  level/taskreporter/qatype/bug
  wazuh/wazuh-documentation#10273 · Filter by author santipadilla opened on Oct 6, 2026

• Wazuh server disk requirements leave out the space the vulnerability detection database needs

  level/taskreporter/qatype/bug
  wazuh/wazuh-documentation#10257 · Filter by author santipadilla opened on Oct 5, 2026
  

• Add a custom IsMalicious indicator-enrichment example

  wazuh/wazuh-documentation#10253 · Filter by author hexablob opened on Oct 3, 2026

• Add "Using the Wazuh dashboard's Endpoints summary" method to the agent remote upgrade documentation

  wazuh/wazuh-documentation#10233 · Filter by author sakib789 opened on Oct 1, 2026

• Documentation build does not work

  wazuh/wazuh-documentation#10190 · Filter by author freeeflyer opened on Sep 24, 2026